[freakinvibe]

This is standard behaviour. What you should do is to set "Disallow 3rd party application downloads" to "False" for everybody that you want to deploy an app to via software configuration and you should leave them on the elevated policy.

But in your software config, you should set the app policy to "Disallow" for any unlisted apps. So your users will only get the apps that you want them and they cannot download any other apps.